Technical data relating to munitions and other war material generated in the United States must be handled in compliance with International Traffic in Arms Regulations (ITAR) issued by the Directorate of Defense Trade Controls (DDTC) of the US State Department. Increasingly, companies are reliant on cloud and other electronic document handling systems for the management of technical data. This is problematic in relation to ITAR regulated data for a number of reasons. It is generally recognized that commercially available public cloud document and file storage, management and collaboration systems contain a comprehensive range of features and enterprise quality security that are impractical if not impossible to design, implement and maintain by any single enterprise or organization for its own documents and purposes. Some commercially available pubic cloud systems merely contain features and functions that reflect a rich and leveraged history of solving a multitude of needs and concerns with regard to the storage, management and collaboration of documents and files, but also they are continually enhanced to incorporate the best available security and updated features at competitively maintained prices. These commercial offerings are consistently greater in function and far less in cost than those of companies not competing in this industry can achieve through their own individual efforts.
Unfortunately, these “best of breed” public cloud storage, management and collaboration solutions, as well as the specific functionality incorporated within these solutions, some of which could enhance compliance with export laws and the administration and reporting of export licenses and technical assistance agreements granted for the export of ITAR-defined technical data, have not been available for use where documents and files contain ITAR-defined technical data. The very features of shared platforms, cloud disbursement of data, and ubiquity (and therefore anonymity) of access that have been viewed as positive attributes of cloud solutions generally have been viewed instead as antithetical to the ITAR. Use of these resources has been judged as automatically resulting in what the ITAR categorizes as “deemed exports,” that is impermissible exports that will be deemed to have occurred because the possessor of export-controlled technical data did not take reasonable steps to preclude such occurrence.
As a consequence of the unavailability to those possessing documents with ITAR-defined technical data of leading public cloud document and file storage, management and collaboration subscription solutions, those possessing such technical data have been forced to implement various, inadequate alternatives. Some have avoided any electronic storage of ITAR-defined technical data, maintaining only “paper” copies of documents and materials containing such data. Others have maintained electronic copies, but have done so often in non-encrypted formats and hoped that through stealth and luck those documents and files would not be disseminated in violation of the ITAR.
Still other enterprises and organizations have attempted to implement and maintain “dark clouds,” which are private computer networks that attempt to capture some of the security, efficiencies and functionality of the best commercial offerings. Such offerings, however, have a substantially greater cost and significantly less functionality and security than could be available in the market from commercial providers if not for the “ITAR” prohibition.
Deficiencies in known systems indicate that: (1) there would be substantial cost savings, enhanced security, and less administrative burden if companies dealing with documents and files containing ITAR-defined technical data could collaborate in the use of those documents and files via common cloud computing practices that are widely recognized at the enterprise level as “best-in-class” to foster high productivity, performance and regulatory compliance; (2) encryption and use restrictions alone are not sufficient to achieve ITAR compliance when using cloud solutions; and (3) the cost of non-compliance, and therefore the lack of a solution to the unavailability of a leading commercial document and file collaboration solution, is high.
Accordingly, there exists a need for a fully functional, public cloud-based document and file storage, management and collaboration system for documents and files containing ITAR-defined technical data.